﻿#include <iostream>
#include <Windows.h>

UINT64 RemoteDll(char* fullDllPathName)
{
    UINT64  nRet64          = 0;
    DWORD   lpexitCode      = 0;
    DWORD   ProcessId       = 0;
    DWORD   ThreadId        = 0;
    SIZE_T  nWriten         = 0;
    HWND    hWnd            = FindWindowA("Direct3DWindowClass",NULL);  //设置注入的目标窗口句柄
   
    printf("WindHwnd \t=> \t%016llX \r\n", (UINT64)hWnd);
    if (!hWnd) return 0;    
    

    // 获取目标进程ID
    GetWindowThreadProcessId(hWnd, &ProcessId);
    printf("ProcessId \t=> \t%016llX \r\n", (UINT64)ProcessId);

    // 获取目标进程窗口句柄
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessId);  
    printf("hProcess \t=> \t%016llX \r\n", (UINT64)hProcess);
    if (!hProcess) return 0;
    

    LPVOID tempAdrs = VirtualAllocEx(hProcess,NULL,1024,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
    printf("tempAdrs \t=> \t%016llX \r\n", (UINT64)tempAdrs);
    if (!tempAdrs) return 0;
    

    WriteProcessMemory(hProcess, tempAdrs, fullDllPathName, strlen(fullDllPathName) + 1,&nWriten);

    // 线程注入
    HANDLE ht = CreateRemoteThread(
        hProcess,NULL,0,(LPTHREAD_START_ROUTINE)LoadLibraryA,
        tempAdrs,0,&ThreadId
    );

    printf("ThreadHandle \t=> \t%016llX \r\n", (UINT64)ht);
    if (!ht) return 0;

    //WaitForSingleObject(ht, 0xffffffff);
    //GetExitCodeThread(ht, &lpexitCode);

    nRet64 = (UINT64)ht;    
    return nRet64;
}


int main()
{
    // 获取当前目录
    char tmpPath[256] = { 0 };
    GetCurrentDirectoryA(256,tmpPath);

    // 拼接完整DLL路径
    //strcat_s(tmpPath,"\\MineDX9Pro.dll");
    strcat_s(tmpPath,"\\NineDX12.dll");
    printf("路径： %s \r\n", tmpPath);

    // 执行注入
    if (!RemoteDll(tmpPath)) printf("注入失败！！ \r\n");
    
    getchar();
}

